deepline 0.3.287 → 0.3.289

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.287',
+  version: '0.3.289',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -371,6 +371,7 @@ import {
   type PlayExecutionSuspension,
 } from './suspension';
 import {
+  createRequestHeaderSecretRedactionContext,
   createSecretRedactionContext,
   type SecretRedactionContext,
 } from './secret-redaction';
@@ -14669,6 +14670,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           if (headers['user-agent'] === undefined) {
             headers['user-agent'] = 'Deepline Play Runtime';
           }
+          const requestRedactor = createRequestHeaderSecretRedactionContext(
+            headers,
+            Object.keys(secretHeaderMarkers),
+          );
           const fetchInit = { ...init, headers };
           delete fetchInit.auth;
           const boundaryId = this.durableBoundaryId(
@@ -14755,18 +14760,18 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               log: (message) => this.runtimeLog(message),
             });
             const rawJson = parseJsonOrNull(bodyText);
-            const redactedBodyText = this.secretRedactor.redactString(bodyText);
-            const output: PlayFetchResponse = {
-              ok: response.ok,
-              status: response.status,
-              statusText: response.statusText,
-              url: response.url,
-              headers: this.secretRedactor.redact(
-                Object.fromEntries(response.headers.entries()),
-              ) as Record<string, string>,
-              bodyText: redactedBodyText,
-              json: this.secretRedactor.redactKnownSecrets(rawJson),
-            };
+            const output: PlayFetchResponse =
+              this.secretRedactor.redactKnownSecrets(
+                requestRedactor.redactKnownSecrets({
+                  ok: response.ok,
+                  status: response.status,
+                  statusText: response.statusText,
+                  url: response.url,
+                  headers: Object.fromEntries(response.headers.entries()),
+                  bodyText,
+                  json: rawJson,
+                }),
+              );
 
             if (!output.ok) {
               this.logCtxFetchHttpFailure({

package/dist/bundling-sources/shared_libs/play-runtime/docflow-node-io.ts

@@ -73,7 +73,7 @@ export type PlayDocflowNodeIoState = {
 };
 
 type PreviewOptions = {
-  redactor?: SecretRedactionContext;
+  redactor?: Pick<SecretRedactionContext, 'redactRegisteredSecrets'>;
 };
 
 const utf8Encoder = new TextEncoder();
@@ -132,26 +132,13 @@ function truncateUtf8(value: string, maxBytes: number): string {
   return `${output}…`;
 }
 
-function redactString(
-  redactor: SecretRedactionContext,
-  value: string,
-  key?: string,
-): string {
-  if (!key) return redactor.redactString(value);
-  const wrapped = redactor.redact({ [key]: value }) as Record<string, unknown>;
-  return typeof wrapped[key] === 'string'
-    ? wrapped[key]
-    : redactor.redactString(value);
-}
-
 function safeString(
   value: unknown,
-  redactor: SecretRedactionContext,
-  key?: string,
+  redactor?: PreviewOptions['redactor'],
 ): string | undefined {
   if (typeof value !== 'string') return undefined;
   return truncateUtf8(
-    redactString(redactor, value, key),
+    redactor?.redactRegisteredSecrets(value) ?? value,
     DOCFLOW_NODE_IO_LIMITS.maxStringBytes,
   );
 }
@@ -161,8 +148,7 @@ function previewValue(
   input: {
     depth: number;
     ancestors: WeakSet<object>;
-    redactor: SecretRedactionContext;
-    key?: string;
+    redactor?: PreviewOptions['redactor'];
   },
 ): PlayDocflowNodeValuePreview {
   if (value === null) return { kind: 'null' };
@@ -170,7 +156,7 @@ function previewValue(
   if (typeof value === 'string') {
     return {
       kind: 'scalar',
-      value: safeString(value, input.redactor, input.key) ?? '',
+      value: safeString(value, input.redactor) ?? '',
     };
   }
   if (typeof value === 'number') {
@@ -207,18 +193,13 @@ function previewValue(
     ) {
       return {
         kind: 'dataset',
-        datasetId:
-          safeString(datasetId.value, input.redactor, 'datasetId') ?? 'dataset',
+        datasetId: safeString(datasetId.value, input.redactor) ?? 'dataset',
         datasetKind: datasetKind.value,
         tableNamespace:
           tableNamespace.ok && tableNamespace.value === null
             ? null
             : tableNamespace.ok
-              ? safeString(
-                  tableNamespace.value,
-                  input.redactor,
-                  'tableNamespace',
-                )
+              ? safeString(tableNamespace.value, input.redactor)
               : undefined,
       };
     }
@@ -239,18 +220,13 @@ function previewValue(
     ) {
       return {
         kind: 'dataset',
-        datasetId:
-          safeString(datasetId.value, input.redactor, 'datasetId') ?? 'dataset',
+        datasetId: safeString(datasetId.value, input.redactor) ?? 'dataset',
         datasetKind: datasetKind.value,
         tableNamespace:
           tableNamespace.ok && tableNamespace.value === null
             ? null
             : tableNamespace.ok
-              ? safeString(
-                  tableNamespace.value,
-                  input.redactor,
-                  'tableNamespace',
-                )
+              ? safeString(tableNamespace.value, input.redactor)
               : undefined,
         rowCount: Math.max(0, Math.floor(count.value)),
       };
@@ -309,7 +285,9 @@ function previewValue(
     const fields: Record<string, PlayDocflowNodeValuePreview> = {};
     for (const [key, descriptor] of selected) {
       const safeKey = truncateUtf8(
-        ledgerSafeDocflowPreviewKey(input.redactor.redactString(key)),
+        ledgerSafeDocflowPreviewKey(
+          input.redactor?.redactRegisteredSecrets(key) ?? key,
+        ),
         DOCFLOW_NODE_IO_LIMITS.maxStringBytes,
       );
       fields[safeKey] =
@@ -317,7 +295,6 @@ function previewValue(
           ? previewValue(descriptor.value, {
               ...input,
               depth: input.depth + 1,
-              key,
             })
           : { kind: 'unavailable', reason: 'access_error' };
     }
@@ -338,7 +315,6 @@ export function buildPlayDocflowNodeIoPreviewMap(
   values: Record<string, unknown>,
   options: PreviewOptions = {},
 ): { values: PlayDocflowNodeIoPreviewMap; truncated: boolean } {
-  const redactor = options.redactor ?? createSecretRedactionContext();
   const previews: PlayDocflowNodeIoPreviewMap = {};
   let truncated = false;
   let entries: Array<[string, unknown]>;
@@ -356,14 +332,15 @@ export function buildPlayDocflowNodeIoPreviewMap(
       break;
     }
     const safePath = truncateUtf8(
-      ledgerSafeDocflowPreviewKey(redactor.redactString(path)),
+      ledgerSafeDocflowPreviewKey(
+        options.redactor?.redactRegisteredSecrets(path) ?? path,
+      ),
       DOCFLOW_NODE_IO_LIMITS.maxStringBytes,
     );
     const preview = previewValue(value, {
       depth: 0,
       ancestors: new WeakSet(),
-      redactor,
-      key: path.split('.').at(-1),
+      redactor: options.redactor,
     });
     const candidate = { ...previews, [safePath]: preview };
     if (
@@ -413,7 +390,6 @@ export function buildPlayDocflowNodeInputPreviewMap(
   captures: readonly PlayDocflowNodeInputCapture[],
   options: PreviewOptions = {},
 ): { values: PlayDocflowNodeIoPreviewMap; truncated: boolean } {
-  const redactor = options.redactor ?? createSecretRedactionContext();
   const values: PlayDocflowNodeIoPreviewMap = {};
   let truncated = false;
   for (const capture of captures.slice(0, DOCFLOW_NODE_IO_LIMITS.maxPaths)) {
@@ -435,15 +411,16 @@ export function buildPlayDocflowNodeInputPreviewMap(
       }
     }
     const safePath = truncateUtf8(
-      ledgerSafeDocflowPreviewKey(redactor.redactString(capture.path)),
+      ledgerSafeDocflowPreviewKey(
+        options.redactor?.redactRegisteredSecrets(capture.path) ?? capture.path,
+      ),
       DOCFLOW_NODE_IO_LIMITS.maxStringBytes,
     );
     const preview: PlayDocflowNodeValuePreview = available
       ? previewValue(current, {
           depth: 0,
           ancestors: new WeakSet(),
-          redactor,
-          key: capture.properties.at(-1) ?? capture.path,
+          redactor: options.redactor,
         })
       : { kind: 'unavailable', reason: 'access_error' };
     const candidate = { ...values, [safePath]: preview };
@@ -494,7 +471,6 @@ function normalizePreview(
       return previewValue(value.value, {
         depth: 0,
         ancestors: new WeakSet(),
-        redactor: createSecretRedactionContext(),
       });
     }
     return null;
@@ -523,11 +499,7 @@ function normalizePreview(
       : null;
   }
   if (value.kind === 'dataset') {
-    const datasetId = safeString(
-      value.datasetId,
-      createSecretRedactionContext(),
-      'datasetId',
-    );
+    const datasetId = safeString(value.datasetId);
     if (
       !datasetId ||
       (value.datasetKind !== 'csv' && value.datasetKind !== 'map')
@@ -542,11 +514,7 @@ function normalizePreview(
         ? { tableNamespace: null }
         : typeof value.tableNamespace === 'string'
           ? {
-              tableNamespace: safeString(
-                value.tableNamespace,
-                createSecretRedactionContext(),
-                'tableNamespace',
-              ),
+              tableNamespace: safeString(value.tableNamespace),
             }
           : {}),
       ...(typeof value.rowCount === 'number' && Number.isFinite(value.rowCount)

package/dist/bundling-sources/shared_libs/play-runtime/ledger-safe-payload.ts

@@ -59,52 +59,33 @@ export function sanitizeOpaqueLedgerPayload(value: unknown): unknown {
   return redactedIssue ? opaqueLedgerPayloadSummary(redactedIssue) : redacted;
 }
 
-/** A receipt payload redacted once, serialized once, and measured from that text. */
+/** A customer receipt value serialized once and measured from the stored text. */
 export type SanitizedRuntimeReceiptPayload = {
-  /** The redacted value. Callers return or re-project this, never the source. */
   value: unknown;
-  /**
-   * Canonical Postgres JSON text for `value`, byte-identical to what
-   * `stringifyPostgresJson(value ?? null)` produces. `jsonb` accepts this text
-   * directly, so the completion path never re-serializes the same output.
-   */
+  /** Canonical Postgres JSON text, passed directly to the jsonb completion write. */
   serialized: string;
-  /** UTF-8 byte length of `serialized`; the measured size the limit is enforced on. */
+  /** UTF-8 byte length of `serialized`. */
   bytes: number;
 };
 
-/**
- * Secret-redact a receipt payload without coupling its 10 MiB cell limit to the
- * ledger, and serialize it exactly once.
- *
- * The limit is enforced on the redacted, serialized value that is actually
- * persisted. Redaction normally shrinks credential-shaped values but can expand
- * short matched strings, so measuring the source instead would be wrong in both
- * directions.
- *
- * Redaction is identity-preserving: a payload carrying no credential comes back
- * as the very object that was passed in, with no deep clone, and is serialized
- * exactly once. Only a payload that actually redacts pays for a rebuilt value.
- */
 export function sanitizeRuntimeReceiptPayloadForStorage(
   value: unknown,
 ): SanitizedRuntimeReceiptPayload {
-  const redacted = ledgerIngressRedactor.redact(value);
   // `undefined` is not JSON. The receipt contract stores it as jsonb `null`,
   // which is exactly what the previous `stringifyPostgresJson(output ?? null)`
   // parameter produced.
-  const serialized = stringifyPostgresJson(redacted ?? null);
+  const serialized = stringifyPostgresJson(value ?? null);
   if (serialized === undefined) {
     throw new TypeError('Runtime receipt output is not JSON-serializable.');
   }
   const bytes = assertSerializedRuntimeReceiptOutputWithinLimit({
     serialized,
-    path: 'runtime receipt output after secret redaction',
+    path: 'runtime receipt output',
   });
-  return { value: redacted, serialized, bytes };
+  return { value, serialized, bytes };
 }
 
-/** Secret-redact a receipt payload without coupling its 10 MiB cell limit to the ledger. */
+/** Enforce the customer receipt byte limit without altering its values. */
 export function sanitizeRuntimeReceiptPayload(value: unknown): unknown {
   return sanitizeRuntimeReceiptPayloadForStorage(value).value;
 }

package/dist/bundling-sources/shared_libs/play-runtime/secret-redaction.ts

@@ -188,6 +188,7 @@ export type SecretRedactionContext = {
   /** Redacts only values registered by the secret resolver, preserving safe diagnostics. */
   redactRegisteredSecrets(value: string): string;
   redactString(value: string): string;
+  /** Redacts registered credential values recursively, without guessing from field names or patterns. */
   redactKnownSecrets<T>(value: T): T;
   redact<T>(value: T): T;
 };
@@ -335,7 +336,7 @@ export function createSecretRedactionContext(
   }
 
   function redactKnownSecrets<T>(value: T): T {
-    if (typeof value === 'string') return redactString(value) as T;
+    if (typeof value === 'string') return redactRegisteredSecrets(value) as T;
     if (Array.isArray(value)) {
       return value.map((entry) => redactKnownSecrets(entry)) as T;
     }
@@ -360,3 +361,48 @@ export function createSecretRedactionContext(
     redact,
   };
 }
+
+const REQUEST_CREDENTIAL_HEADER_NAMES = new Set([
+  'authorization',
+  'cookie',
+  'proxy-authorization',
+  'x-api-key',
+  'api-key',
+  'apikey',
+  'x-auth',
+  'auth-token',
+  'access-token',
+  'refresh-token',
+  'session-token',
+  'x-auth-token',
+  'x-access-token',
+  'x-refresh-token',
+  'x-session-token',
+]);
+
+export function createRequestHeaderSecretRedactionContext(
+  headers: Readonly<Record<string, string>>,
+  sensitiveHeaders: readonly string[] = [],
+): SecretRedactionContext {
+  const redactor = createSecretRedactionContext();
+  const declared = new Set(sensitiveHeaders.map((name) => name.toLowerCase()));
+  for (const [name, value] of Object.entries(headers)) {
+    const normalizedName = name.toLowerCase();
+    if (
+      !REQUEST_CREDENTIAL_HEADER_NAMES.has(normalizedName) &&
+      !declared.has(normalizedName)
+    ) {
+      continue;
+    }
+    redactor.register(value);
+    const auth = /^(?:bearer|basic)\s+(.+)$/i.exec(value.trim());
+    if (auth?.[1]) redactor.register(auth[1]);
+    if (normalizedName === 'cookie') {
+      for (const pair of value.split(';')) {
+        const separator = pair.indexOf('=');
+        if (separator > 0) redactor.register(pair.slice(separator + 1).trim());
+      }
+    }
+  }
+  return redactor;
+}

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -6,7 +6,6 @@ type SecretRedactionOptions = {
   keyPolicy?: 'strict' | 'public-result';
   /** Replace sample cursor values with a non-capability-bearing placeholder. */
   placeholderContinuationValues?: boolean;
-  redactJsonStrings?: boolean;
 };
 
 const SENSITIVE_KEY_PATTERNS = [
@@ -400,83 +399,12 @@ function maybeRedactString(value: string, options: SecretRedactionOptions) {
     : redacted.replace(HIGH_ENTROPY_VALUE_PATTERN, REDACTED_VALUE);
 }
 
-function parseJsonContainerText(value: unknown): unknown {
-  if (typeof value !== 'string') return value;
-  const trimmed = value.trim();
-  if (!trimmed.startsWith('{') && !trimmed.startsWith('[')) return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return value;
-  }
-}
-
-function jsonStringContainsSecrets(
-  value: string,
-  options: SecretRedactionOptions,
-  parentKey?: string,
-  path: readonly string[] = [],
-): boolean {
-  // Inspect parsed values, but never reserialize SQL text and round its numeric literals.
-  const parsed = parseJsonContainerText(value);
-  if (!parsed || typeof parsed !== 'object') return false;
-  const pending = [
-    {
-      value: parsed,
-      parentKey,
-      path: [...path],
-    },
-  ];
-  const textOptions = { ...options, redactJsonStrings: false };
-  while (pending.length > 0) {
-    const current = pending.pop()!;
-    const sourceIsArray = Array.isArray(current.value);
-    for (const [key, rawItem] of Object.entries(current.value)) {
-      const item = parseJsonContainerText(rawItem);
-      const parentKey = sourceIsArray ? current.parentKey : key;
-      if (
-        !sourceIsArray &&
-        options.keyPolicy === 'public-result' &&
-        isPublicResultSafeTokenKey(key, current.path, item) &&
-        (!item || typeof item !== 'object')
-      ) {
-        if (
-          typeof item === 'string' &&
-          maybeRedactString(item, textOptions) !== item
-        )
-          return true;
-        continue;
-      }
-      if (!sourceIsArray && shouldRedactKey(key)) return true;
-      if (item && typeof item === 'object') {
-        pending.push({
-          value: item,
-          parentKey,
-          path: sourceIsArray ? current.path : [...current.path, key],
-        });
-      } else if (
-        typeof item === 'string' &&
-        redactSecretsInValue(item, parentKey, textOptions) !== item
-      ) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-
 export function redactSecretsInValue<T>(
   value: T,
   parentKey?: string,
   options: SecretRedactionOptions = {},
 ): T {
   if (typeof value === 'string') {
-    if (
-      options.redactJsonStrings &&
-      jsonStringContainsSecrets(value, options, parentKey)
-    ) {
-      return REDACTED_VALUE as T;
-    }
     if (hasExplicitSecretValue(value, options)) {
       return REDACTED_VALUE as T;
     }
@@ -519,15 +447,8 @@ export function redactSecretsInValue<T>(
   const redactNestedValue = (
     item: unknown,
     itemParentKey: string | undefined,
-    path: readonly string[],
   ): unknown => {
     if (typeof item !== 'string') return item;
-    if (
-      options.redactJsonStrings &&
-      jsonStringContainsSecrets(item, options, itemParentKey, path)
-    ) {
-      return REDACTED_VALUE;
-    }
     if (hasExplicitSecretValue(item, options)) {
       return REDACTED_VALUE;
     }
@@ -552,15 +473,7 @@ export function redactSecretsInValue<T>(
         (!item || typeof item !== 'object')
       ) {
         const redacted =
-          typeof item === 'string'
-            ? options.redactJsonStrings &&
-              jsonStringContainsSecrets(item, options, itemParentKey, [
-                ...current.path,
-                key,
-              ])
-              ? REDACTED_VALUE
-              : maybeRedactString(item, options)
-            : item;
+          typeof item === 'string' ? maybeRedactString(item, options) : item;
         (current.target as Record<string, unknown>)[key] =
           options.placeholderContinuationValues &&
           isPublicResultCursorKey(key, current.path) &&
@@ -589,7 +502,6 @@ export function redactSecretsInValue<T>(
       (current.target as Record<string, unknown>)[key] = redactNestedValue(
         item,
         itemParentKey,
-        sourceIsArray ? current.path : [...current.path, key],
       );
     }
   }

package/dist/cli/index.js

@@ -3515,7 +3515,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.287",
+  version: "0.3.289",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -5217,7 +5217,7 @@ function createSecretRedactionContext(initialValues = []) {
     return value;
   }
   function redactKnownSecrets(value) {
-    if (typeof value === "string") return redactString(value);
+    if (typeof value === "string") return redactRegisteredSecrets(value);
     if (Array.isArray(value)) {
       return value.map((entry) => redactKnownSecrets(entry));
     }
@@ -46644,16 +46644,27 @@ function resolvePersistentGlobalCommand(dependencies = {}) {
   const pathClis = dependencies.pathClis ?? resolvePathCommands("deepline");
   const homebrewCommand = pathClis.find(isHomebrewFormulaCommand);
   if (homebrewCommand) return homebrewCommand;
-  const plan = resolveShellSpawn("npm", ["prefix", "-g"], platform3);
-  const prefix = run(plan.command, plan.args, {
-    encoding: "utf8",
-    shell: plan.shell
-  });
-  if (prefix.status !== 0) return null;
-  const root = String(prefix.stdout ?? "").trim();
-  if (!root) return null;
-  const candidates = platform3 === "win32" ? [(0, import_node_path27.join)(root, "deepline.cmd"), (0, import_node_path27.join)(root, "deepline")] : [(0, import_node_path27.join)(root, "bin", "deepline")];
-  return candidates.find((candidate) => pathExists(candidate)) ?? null;
+  for (const manager of ["npm", "pnpm"]) {
+    const plan = resolveShellSpawn(
+      manager,
+      manager === "npm" ? ["prefix", "-g"] : ["bin", "-g"],
+      platform3
+    );
+    const result = run(plan.command, plan.args, {
+      encoding: "utf8",
+      shell: plan.shell,
+      cwd: manager === "pnpm" ? (0, import_node_os14.homedir)() : void 0,
+      timeout: 1e4
+    });
+    if (result.status !== 0) continue;
+    const root = String(result.stdout ?? "").trim();
+    if (!root) continue;
+    const bin = manager === "npm" && platform3 !== "win32" ? (0, import_node_path27.join)(root, "bin") : root;
+    const candidates = platform3 === "win32" ? [(0, import_node_path27.join)(bin, "deepline.cmd"), (0, import_node_path27.join)(bin, "deepline")] : [(0, import_node_path27.join)(bin, "deepline")];
+    const command = candidates.find((candidate) => pathExists(candidate));
+    if (command) return command;
+  }
+  return null;
 }
 function inspectGlobalCliAvailability(input2) {
   const pathClis = input2?.pathClis ?? resolvePathCommands("deepline");

package/dist/cli/index.mjs

@@ -3510,7 +3510,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.287",
+  version: "0.3.289",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -5212,7 +5212,7 @@ function createSecretRedactionContext(initialValues = []) {
     return value;
   }
   function redactKnownSecrets(value) {
-    if (typeof value === "string") return redactString(value);
+    if (typeof value === "string") return redactRegisteredSecrets(value);
     if (Array.isArray(value)) {
       return value.map((entry) => redactKnownSecrets(entry));
     }
@@ -46743,16 +46743,27 @@ function resolvePersistentGlobalCommand(dependencies = {}) {
   const pathClis = dependencies.pathClis ?? resolvePathCommands("deepline");
   const homebrewCommand = pathClis.find(isHomebrewFormulaCommand);
   if (homebrewCommand) return homebrewCommand;
-  const plan = resolveShellSpawn("npm", ["prefix", "-g"], platform3);
-  const prefix = run(plan.command, plan.args, {
-    encoding: "utf8",
-    shell: plan.shell
-  });
-  if (prefix.status !== 0) return null;
-  const root = String(prefix.stdout ?? "").trim();
-  if (!root) return null;
-  const candidates = platform3 === "win32" ? [join21(root, "deepline.cmd"), join21(root, "deepline")] : [join21(root, "bin", "deepline")];
-  return candidates.find((candidate) => pathExists(candidate)) ?? null;
+  for (const manager of ["npm", "pnpm"]) {
+    const plan = resolveShellSpawn(
+      manager,
+      manager === "npm" ? ["prefix", "-g"] : ["bin", "-g"],
+      platform3
+    );
+    const result = run(plan.command, plan.args, {
+      encoding: "utf8",
+      shell: plan.shell,
+      cwd: manager === "pnpm" ? homedir9() : void 0,
+      timeout: 1e4
+    });
+    if (result.status !== 0) continue;
+    const root = String(result.stdout ?? "").trim();
+    if (!root) continue;
+    const bin = manager === "npm" && platform3 !== "win32" ? join21(root, "bin") : root;
+    const candidates = platform3 === "win32" ? [join21(bin, "deepline.cmd"), join21(bin, "deepline")] : [join21(bin, "deepline")];
+    const command = candidates.find((candidate) => pathExists(candidate));
+    if (command) return command;
+  }
+  return null;
 }
 function inspectGlobalCliAvailability(input2) {
   const pathClis = input2?.pathClis ?? resolvePathCommands("deepline");

package/dist/index.js

@@ -1328,7 +1328,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.287",
+  version: "0.3.289",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -2968,7 +2968,7 @@ function createSecretRedactionContext(initialValues = []) {
     return value;
   }
   function redactKnownSecrets(value) {
-    if (typeof value === "string") return redactString(value);
+    if (typeof value === "string") return redactRegisteredSecrets(value);
     if (Array.isArray(value)) {
       return value.map((entry) => redactKnownSecrets(entry));
     }

package/dist/index.mjs

@@ -1232,7 +1232,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.287",
+  version: "0.3.289",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -2872,7 +2872,7 @@ function createSecretRedactionContext(initialValues = []) {
     return value;
   }
   function redactKnownSecrets(value) {
-    if (typeof value === "string") return redactString(value);
+    if (typeof value === "string") return redactRegisteredSecrets(value);
     if (Array.isArray(value)) {
       return value.map((entry) => redactKnownSecrets(entry));
     }

package/dist/release.d.mts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.287";
+    readonly version: "0.3.289";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.d.ts

@@ -149,7 +149,7 @@ type SdkRelease = {
     supportPolicy: SdkSupportPolicy;
 };
 declare const SDK_RELEASE: {
-    readonly version: "0.3.287";
+    readonly version: "0.3.289";
     readonly updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.";
     readonly packageCapabilities: {
         readonly updatePreferences: 1;

package/dist/release.js

@@ -74,7 +74,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.287",
+  version: "0.3.289",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/dist/release.mjs

@@ -48,7 +48,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.287",
+  version: "0.3.289",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deepline",
-  "version": "0.3.287",
+  "version": "0.3.289",
   "description": "GTM data CLI and TypeScript SDK for coding agents",
   "license": "MIT",
   "homepage": "https://code.deepline.com",